Offenses

The Activity Monitor App for QRadar feeds a couple of QRadar Offenses.

While the Ransomware Dashboard reports on incidents of Ransomware attacks monitored by Netwrix Threat Prevention, the following offenses may be generated by the Netwrix Activity Monitor App.

QRadar Offense	Definition
INTERCEPT: File System Attacks (By User)	Significant number of file changes made by an account in a short time period
Netwrix: Ransomware Detected	Threshold-based Ransomware Rule